Nearly 4,000 Bitcoin worth approximately $320 million have been withdrawn from the Liquid Network’s federation reserves in one of the largest crypto security incidents of 2026.Liquid confirmed the incident on September 6, saying “purported white-hat hackers” had withdrawn roughly 4,000 BTC from the wallet securing Bitcoin backing for L-BTC, the network’s Bitcoin-pegged asset.The transfer represented approximately 95% of the roughly 4,200 BTC held by the federation before the incident. Liquid subsequently disabled its bridge nodes, preventing new transactions from being submitted and effectively pausing the Bitcoin sidechain while developers investigate the vulnerability.Exchanges were also asked to suspend L-BTC deposits and withdrawals. Bitcoin itself was unaffected. The incident occurred in Liquid, a federated Bitcoin sidechain developed by Blockstream, rather than Bitcoin’s base-layer network.
Elements Bug Apparently Created Invalid L-BTC
Early findings indicate that the withdrawal did not result from compromised federation signing keys. SideSwap said a customer submitted 4,000 L-BTC to its peg-out service at approximately 14:05 UTC on Sunday. The service processed the request normally, burning the L-BTC with valid peg-out authorization. At 14:28 UTC, the Liquid Federation released approximately 3,996 BTC to the customer’s Bitcoin address.Blockstream subsequently determined that the L-BTC presented to SideSwap had been created through a bug in Elements, the open-source software underlying Liquid, according to SideSwap. SideSwap said its systems could not distinguish the affected tokens from legitimate L-BTC. Liquid similarly said the transaction used SideSwap’s valid Peg-out Authorization Key, but emphasized that the key itself had not been compromised.That distinction makes the incident particularly significant. Rather than stealing federation credentials and directly authorizing an illegitimate Bitcoin withdrawal, the apparent vulnerability allowed L-BTC that should not have existed to pass through the normal redemption process and be exchanged for genuine BTC from federation reserves.The precise technical root cause has not yet been confirmed in a final Blockstream postmortem.
Attackers Claim They Will Return Bitcoin
Several hours after the withdrawal, the receiving wallet sent an onchain message identifying the actors as “whitehats” and asking Liquid’s operators to contact them onchain. Blockstream responded through another Bitcoin transaction and began attempting to establish communication. Subsequent messages attributed to the actors indicated that they wanted the vulnerability patched across Liquid nodes before returning the funds.Their claim to be white-hat researchers has not been independently verified, and possession of the Bitcoin remains outside the federation’s control. Liquid has therefore continued treating the event as a security incident. The approximately 4,000 BTC also appeared to remain largely unmoved following the initial consolidation, providing some support for the possibility that the actors are attempting coordinated disclosure rather than immediately laundering the funds.The consequences extend beyond the missing reserves. Liquid supports L-BTC alongside assets including stablecoins and tokenized real-world assets. The network said USDT, DePix and other issued assets were not directly affected, although Liquid-based wallet functionality and transactions have been disrupted by the network pause.The incident also exposes a distinctive risk in federated Bitcoin systems. Liquid’s federation uses specialized infrastructure to control Bitcoin entering and leaving the sidechain, but secure private keys cannot protect reserves if invalid assets can reach an otherwise legitimate redemption mechanism.For now, the most important unanswered questions are whether the full 3,996 BTC will be returned, exactly how the Elements vulnerability allowed the affected L-BTC to be created, and when Liquid can safely resume operations. Until those questions are resolved, approximately $320 million in Bitcoin remains outside the federation’s control and one of Bitcoin’s most established sidechains remains effectively paused.